EFIKEYGEN(1)                General Commands Manual               EFIKEYGEN(1)

<?><?><?> (NAME)
     efikeygen - <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
     <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> PE <?><?><?><?>
     UEFI Secure Boot

<?><?><?><?><?> <?><?><?><?><?> (SYNOPSIS)
     efikeygen <-C | -k | -m> <-S | --signer nickname> -n nickname -c
     common_name [-u url] [-s serial] [-d directory] [-t token]

<?><?><?><?><?><?><?> (DESCRIPTION)
     <?><?><?><?><?> efikeygen <?><?> <?><?><?><?><?> <?><?>
     <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?> <?>
     <?><?><?><?><?><?><?><?> <?><?><?> <?><?><?><?><?><?><?> <?><?> pesign
     <?><?><?>. <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
     <?><?><?><?><?><?><?><?><?> X.509 <?><?><?><?><?> <?>
     <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?> <?><?>
     <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?><?><?>
     <?><?><?><?><?> <?><?><?>.  efikeygen <?><?><?><?><?><?><?><?> <?><?>
     <?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
     <?><?><?><?><?> <?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?><?> PE
     <?><?> UEFI Secure Boot <?><?> <?><?><?> <?><?><?><?><?><?>
     <?><?><?><?><?> <?><?><?><?><?><?>.


<?><?><?><?><?><?><?><?> (OPTIONS)
     -C | --ca
             <?><?><?><?><?> <?><?> <?><?><?><?><?> CA

     -k | --kernel
             <?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?>
             <?><?><?><?> (kernel)

             <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?><?><?> CA
             <?><?><?><?><?><?><?> <?><?><?>

     -m | --module
             <?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?>
             <?><?><?><?><?>

             <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?><?><?> CA
             <?><?><?><?><?><?><?> <?><?><?>

     -S | --self-sign
             <?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>

     --signer nickname
             <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> NSS <?><?><?><?><?>
             <?><?><?><?><?><?><?><?> <?><?><?><?> nickname
             <?><?><?><?><?><?><?><?> <?><?><?><?><?>
             <?><?><?><?><?><?><?><?><?>

     -n nickname | -nickname nickname
             <?><?><?><?><?> <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?>
             <?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?><?><?> NSS <?><?>
             nickname

     -c common_name | --common-name common_name
             <?><?><?> <?><?><?><?><?> (Common Name)
             <?><?><?><?><?><?><?><?><?> X.509 <?><?><?><?> <?><?><?><?><?>
             <?><?><?><?><?><?><?><?>. <?><?><?> <?><?><?><?><?> <?><?><?><?>
             <?><?> <?><?><?><?><?><?> <?><?><?><?> rfc2253 <?><?><?><?><?>
             <?><?><?><?><?>:
             "CN=John Doe,OU=editing,O=New York Times,L=New York,ST=NY,C=US"

     -u url | --url url
             <?><?><?><?><?> <?><?><?><?><?><?><?><?> (URL) <?><?><?><?>
             <?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?>
             <?><?><?> <?><?><?><?><?> <?> <?><?><?><?><?>
             <?><?><?><?><?><?><?> <?><?> <?><?>.

     -s serial | --serial serial
             <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
             <?><?><?><?><?><?><?> <?><?> <?><?><?> <?><?><?><?>. <?><?>
             <?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?> <?>
             <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?>
             <?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?>
             <?><?><?> <?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?>
             <?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?><?>
             <?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?>.
             <?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?>
             <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?>
             <?><?><?><?><?> <?><?><?><?><?><?>. <?><?><?><?><?><?><?> <?><?>
             <?><?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?><?>
             <?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>.

     -d directory | --dbdir directory
             <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?>
             <?><?><?><?> NSS
             (<?><?><?><?><?><?><?>: /etc/pki/pesign)

     -t token | --token token
             <?><?><?> <?><?><?><?> NSS <?><?><?> <?><?><?><?><?><?><?>
             (<?><?><?><?><?><?><?>: pkcs11:token=NSS%20Certificate%20DB)

   YubiKey

     <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?>
     <?><?><?><?><?> <?> <?><?><?><?><?><?><?><?> CA <?> <?><?>
     <?><?><?><?><?> <?> <?><?><?><?><?><?><?><?> <?><?><?><?><?>
     <?><?><?><?><?> <?> <?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?>
     <?><?><?><?><?><?><?><?><?><?> PIV <?><?><?><?><?> <?><?> yubikey
     <?><?><?><?> <?><?><?>:

     <?><?><?><?><?> <?><?><?><?><?><?>:

      # <?><?><?><?> <?><?> <?><?><?><?> CA <?><?><?><?>
      host:~$ efikeygen -C -n my-ca -S \
              -c "CN=CA Person,OU=My Org's CA,O=My Org" \
              -u https://myorg.example.com/ca/

      # <?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
      host:~$ efikeygen -n my-signer --signer my-ca -k \
              -c "CN=Secure Boot Signer,OU=My Org's CA,O=My Org" \
              -u https://myorg.example.com/ca/

     <?><?><?><?><?> CA <?><?><?> <?><?> yubikey:

      # <?><?><?><?><?> <?><?> <?><?> <?><?> <?><?><?><?> PKCS-12
      host:~$ pk12util -d /etc/pki/pesign -o myca.pk12 -n my-ca
      Enter password for PKCS12 file: <<?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Re-enter password: <<?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      pk12util: PKCS12 EXPORT SUCCESSFUL

      # <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?> yubikey
      host:~$ yubico-piv-tool -s 9c -a import-key -K PKCS12 \
              -c -i myca.pk12
      Enter PEM pass phrase: <<?><?><?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Successfully imported a new private key.

      # <?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?> yubikey
      host:~$ yubico-piv-tool -s 9c -a import-certificate \
              -K PKCS12 -i myca.pk12
      Enter PEM pass phrase: <<?><?><?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Successfully imported a new certificate.

      # <?><?><?> <?><?><?><?><?> CA <?><?> <?><?><?><?><?><?><?><?><?><?><?> NSS
      host:~$ certutil -d /etc/pki/pesign -D -n my-ca

     <?><?><?><?><?> yubikey<?><?> <?><?> <?><?><?><?><?><?><?> <?><?><?><?>
     <?> <?><?><?><?><?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?>
     <?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>:

      # <?><?><?><?><?> <?><?> <?><?> <?><?> <?><?><?><?> PKCS-12
      host:~$ pk12util -d /etc/pki/pesign -o mysigner.pk12 -n my-signer
      Enter password for PKCS12 file: <<?><?> <?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Re-enter password: <<?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      pk12util: PKCS12 EXPORT SUCCESSFUL

      # <?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?> yubikey
      host:~$ yubico-piv-tool -s 9c -a import-key -K PKCS12 \
              -i mysigner.pk12
      Enter PEM pass phrase: <<?><?><?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Successfully imported a new private key.

      # <?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?> yubikey
      host:~$ yubico-piv-tool -s 9c -a import-certificate \
              -K PKCS12 -i mysigner.pk12
      Enter PEM pass phrase: <<?><?><?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Successfully imported a new certificate.

      # <?><?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?><?><?> NSS
      host:~$ certutil -d /etc/pki/pesign -D -n my-signer

     <?><?> <?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?>
     <?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
     <?><?><?><?><?><?><?><?><?>:

      # <?><?> <?><?> <?><?> <?><?> <?><?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?> PIN <?><?><?><?><?> <?><?>
      # Yubikey <?><?> <?><?><?><?> <?><?><?><?>. <?><?><?> <?><?><?><?><?> <?> <?><?><?> <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?>
      # <?><?><?><?> <?><?><?> <?><?> PKCS-11 <?><?><?><?><?><?> <?><?><?>. <?><?><?><?><?><?>.
      host:~$ pesign -s -t 'Secure Boot Signer' \
              -c "Certificate for Digital Signature" \
              -i shimx64.efi -o shimx64.signed.efi
      Enter Password or Pin for "Secure Boot Signer": <PIN <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Enter passphrase for private key: <<?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Enter passphrase for private key: <<?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>

     <?><?><?><?><?> <?><?><?> <?><?><?><?><?><?> <?><?> <?><?>
     <?><?><?><?><?> <?><?><?><?>:

      host:~$ pesign -i shimx64.signed.efi -l
      ---------------------------------------------
      certificate address is 0x7fbbae061468
      Content was not encrypted.
      Content is detached; signature cannot be verified.
      The signer's common name is Secure Boot Signer
      No signer email address.
      Signing time: Wed May 15, 2019
      There were certs or crls included.
      ---------------------------------------------

     <?><?><?><?>!.Ss OpenSC (<?><?><?><?> <?><?><?><?><?><?>) <?><?>
     <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?> <?>
     <?><?><?><?><?><?><?><?> CA <?> <?><?> <?><?><?><?><?> <?>
     <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?> <?><?><?>
     <?><?><?><?> <?><?><?><?> (import) <?><?><?><?><?> <?><?>
     <?><?><?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?> CardOS
     <?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?> OpenSC <?><?><?><?><?>
     <?><?><?> <?><?><?>:

     <?><?> <?><?><?><?> <?><?><?><?><?><?> <?><?><?><?> <?><?>
     <?><?><?><?><?><?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?><?><?><?>
     PKCS15 <?><?> <?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?>
     <?><?><?><?>:

      # <?><?><?><?><?><?><?><?><?> <?><?><?><?>
      host:~$ cardos-tool -f
      Using reader with a card: Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00
      card in administrative state, ok

      # <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?> PKCS15 <?><?><?><?><?> <?><?><?><?><?> PIN <?><?><?><?> <?><?><?><?><?> (Security Officer) <?> <?><?> <?><?><?><?><?><?><?><?>.
      host:~$ pkcs15-init -CT --so-pin $SOPIN --so-puk $SOPUK
      Using reader with a card: Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00

      # <?><?><?><?><?><?><?><?> <?><?><?><?><?> PIN <?> <?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?>
      host:~$ pkcs15-init -P -a 1 --pin $PIN --puk $PUK \
              --so-pin $SOPIN --so-puk $SOPUK \
              --label "myorg-sb-ca"
      Using reader with a card: Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00

     <?><?><?><?><?> <?><?><?><?><?><?> <?> <?><?><?><?><?><?><?><?>:

      # <?><?><?><?><?> <?><?> <?><?><?><?> <?> <?><?><?><?><?> CA <?><?><?><?>
      host:~$ efikeygen -C -n my-ca -S \
              -c "CN=My Org's Secure Boot CA,OU=My Org's CA,O=My Org" \
              -u https://myorg.example.com/ca

      # <?><?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?> <?><?><?><?><?> <?><?><?><?>
      host:~$ efikeygen -n my-signer --signer my-ca -k \
              -c "CN=My Org's SB Signer,OU=My Org's CA,O=My Org"\
              -u https://myorg.example.com/ca

     <?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?>

      # <?><?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?> CA <?><?> <?><?> <?><?><?><?> PKCS-12
      host:~$ pk12util -d /etc/pki/pesign -o my-ca.p12 -n my-ca
      Enter password for PKCS12 file: <<?><?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Re-enter password: <<?><?> <?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      pk12util: PKCS12 EXPORT SUCCESSFUL

      # <?><?><?><?> <?><?><?><?> <?><?><?><?> PKCS-12 <?><?> <?><?><?><?> <?><?><?><?>
      host:~$ pkcs15-init --store-private-key my-ca.p12 \
              --format pkcs12 --auth-id 01 \
              --pin $PIN --so-pin $SOPIN --so-puk $SOPUK
      Using reader with a card: Generic Smart Card Reader Interface [Smart Card Reader Interface] (20070818000000000) 00 00
      Importing 1 certificates:
         0: /CN=My Org's Secure Boot CA

      # <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?>:
      host:~$ pkcs11-tool --module opensc-pkcs11.so -l --pin $PIN -O
      Using slot 1 with a present token (0x1)
      Private Key Object; RSA
        label:      Private Key
        ID:         de61fac87e0315352e7b9a487377ace2f6354d9b
        Usage:      sign
      Certificate Object, type = X.509 cert
        label:      /CN=My Org's Secure Boot CA
        ID:         de61fac87e0315352e7b9a487377ace2f6354d9b
      Public Key Object; RSA 2048 bits
        label:      /CN=My Org's Secure Boot CA
        ID:         de61fac87e0315352e7b9a487377ace2f6354d9b
        Usage:      encrypt, verify

      # <?><?><?><?><?> <?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> nss <?><?><?><?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?>
      host:~$ modutil -dbdir /etc/pki/pesign/ -list
      Listing of PKCS #11 Modules
      -----------------------------------------------------------
        1. NSS Internal PKCS #11 Module
           slots: 2 slots attached
          status: loaded

           slot: NSS Internal Cryptographic Services
          token: NSS Generic Crypto Services

           slot: NSS User Private Key and Certificate Services
          token: NSS Certificate DB

        2. opensc-pkcs11
          library name: /usr/lib64/pkcs11/opensc-pkcs11.so
           slots: 2 slots attached
          status: loaded

           slot: Virtual hotplug slot
          token:

           slot: Generic Smart Card Reader Interface [Smart Card Read...
          token: OpenSC Card (myorg-sb-ca)
      -----------------------------------------------------------

      # <?><?><?><?><?> <?> <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> NSS <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?>:
      host:~$ certutil -d /etc/pki/pesign -L \
              -h "OpenSC Card (myorg-sb-ca)"
      Certificate Nickname                             Trust Attributes
                                                       SSL,S/MIME,JAR/XPI

      Enter Password or Pin for "OpenSC Card (myorg-sb-ca)": <PIN <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      OpenSC Card (myorg-sb-ca):/CN=My Org's Secure Boot CA    u,u,u

      # <?><?><?> CA <?><?> <?><?><?><?><?><?><?><?><?><?><?> NSS
      host:~$ certutil -d /etc/pki/pesign -D -n my-ca

     <?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?><?>
     <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?> <?><?><?><?> <?>
     <?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?>
     <?><?><?><?><?><?><?><?><?> (signer) <?><?><?> <?><?><?><?><?>
     <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?> YubiKey<?>
     <?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?>
     <?><?><?><?> <?><?><?><?> <?><?><?> <?><?> <?><?><?><?>
     <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?> <?> <?><?><?><?><?>
     <?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?> <?><?><?><?>:

      # <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?>. <?><?> <?><?> <?><?> <?><?> <?><?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?> PIN
      # <?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?>. <?><?><?> <?><?><?><?> <?> <?><?><?> <?><?><?><?><?><?> <?><?><?><?>
      # <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?> PKCS-11 <?><?><?>. <?><?><?><?> <?><?><?><?><?><?><?><?>.
      host:~$ pesign -s -t "OpenSC Card(myorg-sb-signer)" \
              -c "OpenSC Card (myorg-sb-signer):/CN=My Org's SB Signer"\
              -i shimx64.efi -o shimx64.signed.efi
      Enter Password or Pin for "My Org's SB Signer": <PIN <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Enter passphrase for private key: <PIN <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>
      Enter passphrase for private key: <PIN <?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?>>

      # <?><?><?><?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?>:
      host:~$ pesign -i shimx64.signed.efi -l
      ---------------------------------------------
      certificate address is 0x7fbbae061468
      Content was not encrypted.
      Content is detached; signature cannot be verified.
      The signer's common name is My Org's SB Signer
      No signer email address.
      Signing time: Wed Jun 2, 2020
      There were certs or crls included.
      ---------------------------------------------

     <?><?><?><?><?> <?><?><?><?>!.Sh "<?><?><?><?><?><?><?><?><?><?><?>
     (STANDARDS)" B. Kaliski, PKCS #7: Cryptographic Message Syntax v1.5,
     Internet Engineering Task Force, RFC 2315,
     https://tools.ietf.org/html/rfc2315 , <?><?><?><?> <?><?><?><?>.

     K. Moriarty, M. Nystrom, S. Parkinson, A. Rusch, and M. Scott, PKCS #12:
     Personal Information Exchange Syntax v1.1, Internet Engineering Task
     Force, RFC 7292, https://tools.ietf.org/html/rfc7292 , <?><?><?><?><?>
     <?><?><?><?>.

     PKCS11 Technical Committee, PKCS#11: Cryptographic Token Interface
     Standard, OASIS, https://www.cryptsoft.com/pkcs11doc.

<?><?><?><?><?><?> <?><?><?><?><?><?> (SEE ALSO)
     certutil(1), modutil(1), opensc-tool(1), pesign(1), pk12util(1),
     pkcs15-init(1), yubico-piv-tool(1),

<?><?><?><?><?><?><?><?><?> (AUTHORS)
     Peter Jones

Linux                            June 3, 2020                            Linux